Home / Maritime Cybersecurity
For ship managers, shipowners, and maritime companies in Cyprus · ISM Code, NIS2 Annex I, and locked ashore backups
Your vessels are at sea. Your fleet systems and backups sit in Limassol. If ransomware locks your planned maintenance, crewing, and chartering systems ashore and deletes your backups, the ships keep moving while your office loses control.
Limassol is the largest third-party ship management centre in the European Union. Fleet operations, crewing, technical management, and chartering run on servers on the island, connected to vessels around the world over satellite links. Identiqa places 2U AuraLink hardware with locked backups into your rack in Cyprus, keeps your shore servers clean with AuraCore, and gives your board an External CISO for ISM Code audits, charterer vetting, and NIS2.
A modern ship manager runs an always-on logistics and engineering network from the island. That concentration makes the shore office the primary target for ransomware and extortion groups.
Planned maintenance, crewing, payroll, procurement, and chartering run from servers on the island. If ransomware locks the shore office and wipes its backups, the vessels keep moving, and nobody ashore can clear port papers, order spares, or rotate crew.
Always-on high-bandwidth satellite links connect vessel networks with shore IT for telemetry and maintenance updates. Without hard enforcement at the shore edge, an intruder in the office can reach onboard systems, or an infected contractor laptop aboard can call back into Limassol.
Attackers don't break encryption. They sign in with a captured domain administrator account and erase the backup snapshots before deploying ransomware. A backup that an administrator can delete won't survive a targeted attack.
A binder of policies no longer passes a thorough TMSA review, a RightShip inspection, or a NIS2 check by the Digital Security Authority. Inspectors want technical evidence of containment, locked backups, and board oversight.
Flag states, classification societies, charterers, and the Digital Security Authority each ask for evidence that cyber risk is governed and backups can be restored.
Since 1 January 2021, cyber risk management has to be part of your Safety Management System (SMS) and is verified at every annual Document of Compliance (DoC) audit.
Under Law 89(I)/2020 as amended by Law 60(I)/2025, sea and coastal passenger and freight transport companies and port managing bodies in Cyprus are in Annex I. Individual vessels are not separate entities, yet a significant incident at the shipping company triggers the six-hour early warning to the Digital Security Authority.
Oil majors and dry-bulk charterers inspect how your shore office in Limassol separates fleet networks, protects backups against deletion, and assigns security governance before a vessel is cleared.
For newbuilds contracted since 1 July 2024, classification societies require documented cyber resilience of the vessel as an integrated asset (UR E26) and of onboard systems and equipment (UR E27).
| Framework | Who is covered | When it is checked or due | Authority or auditor |
|---|---|---|---|
| NIS2 (Law 89(I)/2020, amended 2025) | Shipping companies in Annex I (medium-sized or larger) | Early warning within 6 hours, notification within 72 hours, final report after 1 month | Digital Security Authority (DSA) |
| ISM Code (IMO MSC.428(98)) | Every company holding a Document of Compliance (DoC) | Verified at every annual company DoC audit and vessel Safety Management Certificate (SMC) audit | Flag state administration / Recognised Organisation |
| IACS UR E26 & E27 | Newbuild vessels contracted on or after 1 July 2024 | Design, commissioning, and lifecycle verification across shipyards, suppliers, and owners | IACS Classification Society |
| GDPR (Article 33) | Crew, passenger, and shore staff personal data | Notification within 72 hours of becoming aware of a breach likely to put people's rights at risk | Commissioner for Personal Data Protection |
Sources: Annex I and Article 35B of Law 89(I)/2020 as amended by Law 60(I)/2025, IMO Resolution MSC.428(98), IACS UR E26/E27, Article 33 GDPR.
Hardware in your rack on the island, clean shore servers, and a security lead who knows what a Document of Compliance auditor and the Digital Security Authority ask for.
Our 2U appliance works beside the firewall you already run. It stops lateral movement at the shore edge, guards the gateway to your fleet VPNs, and locks every backup snapshot in the storage controller, where even a stolen administrator account can't erase it.
Watches your planned maintenance, crewing, document control, and ERP servers across Linux, FreeBSD, virtual machines, Kubernetes, and Docker from within. It removes hidden backdoors using cryptographically signed commands, never an open shell.
An experienced security lead from Identiqa who owns the cyber chapter of your Safety Management System, prepares the evidence for DoC audits, charterer vetting, and the Digital Security Authority, and reports directly to your board in Limassol.
When an incident hits a company in scope of the Cypriot NIS2 law, the early warning to the Digital Security Authority is due within six hours. AuraLink records what was blocked and when, giving your team verified facts from the first hour.
Tell us how many vessels you manage, what runs in your Limassol office, and which audit or vetting is coming up next. The first architecture briefing is free of charge.
cyprus@identiqa.comSea and coastal passenger and freight transport companies and the managing bodies of ports are listed in Annex I of the Security of Networks and Information Systems Law 89(I)/2020, as amended by Law 60(I)/2025. Companies in those sectors that are medium-sized or larger (50 or more employees, or annual turnover and balance sheet both above EUR 10 million) fall in scope. The Annex explicitly excludes the individual vessels, so the duties attach to the company ashore.
AuraLink sits in your rack in Cyprus beside your existing firewall, guarding the shore network and the gateways where satellite and fleet VPN connections terminate. AuraCore protects the shore servers that sync maintenance, crewing, and safety data with the fleet, ensuring that a compromise on either side is contained before it spreads.
No. AuraLink locks every backup snapshot inside its own storage controller on dedicated 2U hardware in your rack. Even if an attacker captures your highest Windows or hypervisor administrator account, the storage layer refuses deletion until the retention lock expires.
Yes. We serve shipping companies and ship managers in Cyprus as External CISO (CISO as a Service). We maintain the cyber risk management procedures inside your Safety Management System, prepare the technical evidence for Document of Compliance audits, TMSA and RightShip vetting, and report to your management body under Article 35A of the Cypriot NIS law.
This page summarises maritime cybersecurity regulations and Cypriot law. It is not legal advice.